Norway's Aid Agency Norad Breached, Data of All 20,614 Grant Portal Users Stolen
Norad, Norway's national aid agency, confirmed that attackers compromised 27 accounts to gain access to its grant portal, exfiltrating names and email addresses of all 20,614 registered users across 12,511 organizations. Grant application data from at least three organizations was also exposed, with Norad warning the number could grow as the investigation continues. The intrusion was detected on October 30, 2026, though the duration of attacker access remains unclear. Norad has not disclosed the initial access method or attributed the attack, and has engaged external cybersecurity experts to determine the full scope of compromised data. Of particular concern is the possibility that names of applicants located in conflict zones and authoritarian states may be among the stolen records, posing potential safety risks.
Detalhes técnicos
The attackers used 27 compromised accounts to access the grant portal, which has been operational since 2017 and manages applications from organizations worldwide, including support for independent journalism in Moldova, aid for Ukrainian children and POWs, and humanitarian efforts in Gaza. Norad has not specified the initial access vector or techniques used.
Remediação
Norad has established a crisis team and is working with external cybersecurity experts to fully assess the scope of the breach. The agency states its services remain safe to use while the investigation continues, though it has not confirmed when or if affected users will be individually notified.
Linha do tempo
-
Norway's Aid Agency Norad Breached, Data of All 20,614 Grant Portal Users Stolen
ler a análise desta fonte ocultar
Norad, Norway's national aid agency, confirmed that attackers compromised 27 accounts to gain access to its grant portal, exfiltrating names and email addresses of all 20,614 registered users across 12,511 organizations. Grant application data from at least three organizations was also exposed, with Norad warning the number could grow as the investigation continues. The intrusion was detected on October 30, 2026, though the duration of attacker access remains unclear. Norad has not disclosed the initial access method or attributed the attack, and has engaged external cybersecurity experts to determine the full scope of compromised data. Of particular concern is the possibility that names of applicants located in conflict zones and authoritarian states may be among the stolen records, posing potential safety risks.
Technical Details
The attackers used 27 compromised accounts to access the grant portal, which has been operational since 2017 and manages applications from organizations worldwide, including support for independent journalism in Moldova, aid for Ukrainian children and POWs, and humanitarian efforts in Gaza. Norad has not specified the initial access vector or techniques used.
Remediation
Norad has established a crisis team and is working with external cybersecurity experts to fully assess the scope of the breach. The agency states its services remain safe to use while the investigation continues, though it has not confirmed when or if affected users will be individually notified.